Feature | Add oidc/session/whoami endpoint

[matiasperrone-exo]

Summary

Task request:

depends on https://tipit.avaza.com/task#task=3862033

UC

if user is logged first at legacy.openstack.org and then navigates back to any page of marketing site ( GS counterpart ) user is logged off we need to be able to autologin user at marketing site if they are already logged at legacy ( silverstripe)

1. create lite weight endpoint called GET oidc/session/whoiam

endpoint should check silverstripe session and return 200 OK with email and user id as body ( JSON ) or 404 if not logged

endpoint should support X-CSRF-Token

2. marketing site , if user is not logged ( check reducer) should query that endpoint on page load and if returns 200 should trigger login flow with email as a hint

dev notes

repos

https://github.com/OpenStackweb/openstack-org

https://github.com/OpenStackweb/marketing-site

Changes

• Add oidc/session/whoami endpoint with the requested functionality,

Testing

Using CURL:

curl 'http://localhost:9000/oidc/session/whoami' \
  -X 'POST' \
  -H 'Accept: */*' \
  -H 'Accept-Language: es-419,es;q=0.9,en-US;q=0.8,en;q=0.7,es-ES;q=0.6,en-GB;q=0.5,es-AR;q=0.4,es-MX;q=0.3' \
  -H 'Connection: keep-alive' \
  -H 'Content-Length: 0' \
  -b '_gcl_au=1.1.1303657569.1755799845; _ga=GA1.1.430326254.1755799845; _fbp=fb.0.1755799845466.486871936358385000; klaro=%7B%22google-tag-manager%22%3Atrue%2C%22google-analytics%22%3Atrue%7D; _ga_YQSD5D1F6S=GS2.1.s1755808292$o2$g0$t1755808292$j60$l0$h0; GetTextLocale=en_US; _uetvid=cf8184c077a411f09a80b34c59e34abf; _gid=GA1.1.161397762.1757339417; _uetsid=503875308cbb11f09d772b5b47162636; user_date=2025-9-11; idToken=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwczovL3Rlc3RvcGVuc3RhY2tpZC5vcGVuc3RhY2sub3JnIiwic3ViIjoiMTE0MjY2IiwiYXVkIjoiaDF3VlRWbTc1VEpTbVZjS3RWWHRZZXFjLU5LcU1IODYub3BlbnN0YWNrLmNsaWVudCIsImlhdCI6MTc1NzYxNDUyNCwiZXhwIjoxNzU3NjE4MTI0LCJqdGkiOiJLQlpJNW5CSGpvd3Z4SlIzeXhqbVFLTHU3TzZiVzlzQUZTOHU4SDZsTW1rWmZTOTNaSzVqa3lwTEFZeElYYU03eWVITGdLekxtZUROdVRwbXRTMGszZyIsIm5hbWUiOiJNYXRpYXMgUGVycm9uZSIsImdpdmVuX25hbWUiOiJNYXRpYXMiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJtYXRpYXMucGVycm9uZSIsImZhbWlseV9uYW1lIjoiUGVycm9uZSIsIm5pY2tuYW1lIjoibWF0aWFzLnBlcnJvbmUiLCJwaWN0dXJlIjoiaHR0cHM6Ly93d3cuZ3JhdmF0YXIuY29tL2F2YXRhci8wYWQ3NDRhZTNjZjIzMDc0OTRmMDQ1YWUwZmJjOTEwMCIsImJpcnRoZGF0ZSI6IjE5NzgtMDUtMjEgMDA6MDA6MDAiLCJnZW5kZXIiOiJNYWxlIiwiZ2VuZGVyX3NwZWNpZnkiOiIiLCJsb2NhbGUiOiIiLCJiaW8iOiIiLCJzdGF0ZW1lbnRfb2ZfaW50ZXJlc3QiOiIiLCJpcmMiOiIiLCJnaXRodWJfdXNlciI6Im1hdGlhc3BlcnJvbmUtZXhvIiwid2VjaGF0X3VzZXIiOiIiLCJ0d2l0dGVyX25hbWUiOiIiLCJsaW5rZWRfaW5fcHJvZmlsZSI6IiIsImNvbXBhbnkiOiIiLCJqb2JfdGl0bGUiOiIiLCJwdWJsaWNfcHJvZmlsZV9zaG93X3Bob3RvIjpmYWxzZSwicHVibGljX3Byb2ZpbGVfc2hvd19iaW8iOnRydWUsInB1YmxpY19wcm9maWxlX3Nob3dfc29jaWFsX21lZGlhX2luZm8iOmZhbHNlLCJwdWJsaWNfcHJvZmlsZV9zaG93X2Z1bGxuYW1lIjpmYWxzZSwicHVibGljX3Byb2ZpbGVfYWxsb3dfY2hhdF93aXRoX21lIjpmYWxzZSwicHVibGljX3Byb2ZpbGVfc2hvd190ZWxlcGhvbmVfbnVtYmVyIjpmYWxzZSwiZ3JvdXBzIjpbeyJpZCI6MSwiY3JlYXRlZF9hdCI6MTU2NTExMTMzMCwidXBkYXRlZF9hdCI6MTU2NTExMTMzMCwibmFtZSI6InN1cGVyIGFkbWlucyIsInNsdWciOiJzdXBlci1hZG1pbnMiLCJhY3RpdmUiOnRydWUsImRlZmF1bHQiOmZhbHNlfV0sImFkZHJlc3MiOnsiY291bnRyeSI6IkFSIiwic3RyZWV0X2FkZHJlc3MiOiIgIiwiYWRkcmVzczEiOiIiLCJhZGRyZXNzMiI6IiIsInBvc3RhbF9jb2RlIjoiIiwicmVnaW9uIjoiIiwibG9jYWxpdHkiOiIiLCJmb3JtYXR0ZWQiOiIgLCBBUiJ9LCJlbWFpbCI6Im1hdGlhcy5wZXJyb25lQGV4b21pbmRzZXQuY28iLCJzZWNvbmRfZW1haWwiOiJoZWxsb0BtYXRpYXNwZXJyb25lLmNvbSIsInRoaXJkX2VtYWlsIjoiIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsInB1YmxpY19wcm9maWxlX3Nob3dfZW1haWwiOmZhbHNlLCJub25jZSI6IndzbnRiWHk1VTdkb2Rad2sifQ.; PHPSESSID=8tvsdsdb4ehdel3n12b0kj1rsb; _ga_LQC4JWNC08=GS2.1.s1757618594$o24$g1$t1757624949$j52$l0$h0' \
  -H 'Origin: http://localhost:9000/' \
  -H 'Referer: http://localhost:9000/' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0' \
  -H 'content-type: application/json' \
  -H 'sec-ch-ua: "Chromium";v="140", "Not=A?Brand";v="24", "Microsoft Edge";v="140"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Windows"'

Using fetch:

function testFn() {
    const myHeaders = new Headers();
    myHeaders.append("Content-Type", "application/json");
    myHeaders.append("X-CSRF-Token", "d8f86ee0975b3fc664f5c5409165eec7206cb129");
    
  const host = location.protocol + '//' + location.hostname + (location.port ? ':' + location.port : '');
  const myRequest = new Request(`${host}/oidc/session/whoami`, {
      method: "POST",
      body: '',
      headers: myHeaders,
    });
    
    return fetch(myRequest);
}
testFn().then(console.log)

[smarcet]

@matiasperrone-exo please review comments

[smarcet]

@matiasperrone-exo please review comments

[matiasperrone-exo]

The changes requested were incorporated.